AWS Postgres MCP Server: Bypass of Read-Only Keyword Blacklist & Least-Privilege Hardening

Vulnerability Key Information Summary Vulnerability Overview This page is the PyPI project page for , which includes a Security Consideration note: Read-only execution of is "best effort": When the MCP server is not run with , it rejects queries that appear to modify data or session state. This mechanism is implemented via a keyword and function blacklist, such as / / , session state statements (e.g., / / ), and low-impact functions (e.g., , , , etc.). Limitations: The blacklist cannot enumerate all dangerous constructs, and sufficiency queries (subqueries, quoted identifiers, new service/extension functions, etc.) may bypass this mechanism. Best Practice: Connect the MCP server to a least-privilege Postgres role, granting only the permissions it actually requires. Scope of Impact Affected component: (AWS Labs Postgres MCP Server, version 1.1.7). Risk point: When write queries are not enabled, read-only execution relies on the keyword/function blacklist, posing a risk of being bypassed by sufficiency queries, potentially leading to unintended data modifications or session state changes. Applicable database types: APG (Amazon Aurora PostgreSQL), RPG (Amazon RDS for PostgreSQL). Remediation 1. Enable write queries: Set in the MCP configuration to explicitly allow write operations, avoiding reliance on the "best effort" blacklist mechanism. 2. Use a least-privilege role: Create a Postgres role with only the necessary permissions for the MCP server, restricting the scope of SQL operations it can execute. 3. Reference sample read-only role (provided on the page): POC / Exploitation Code The page does not contain a POC or exploitation code for this vulnerability; it only provides the above least-privilege role SQL example as a mitigation measure.

Goal Reached Thanks to every supporter — we hit 100%!

AWS Postgres MCP Server: Bypass of Read-Only Keyword Blacklist & Least-Privilege Hardening